Buyer's guide · Data residency
Start with the thing most articles on this subject get wrong: the DPDP Act does not require you to store personal data in India. The Digital Personal Data Protection Rules were notified on 13 November 2025 and adopt a negative-list model, meaning transfers abroad are permitted by default unless the government specifically restricts a destination. Genuine localisation obligations exist, but they are narrower than the marketing suggests — they come from RBI rules on payment data, from sectoral regulators, from the still-unnotified categories that will apply to Significant Data Fiduciaries, and increasingly from enterprise customers who write residency into contracts regardless of what the law says. This page covers who genuinely hosts data in India and when that actually matters to you.
India's largest home-grown hyperscale operator
Yotta, part of the Hiranandani group, runs some of the largest data centres in the country — NM1 in Navi Mumbai alone spans roughly 820,000 square feet — with further capacity in Greater Noida. It is Indian-owned end to end, which matters for buyers whose concern is not merely where the bytes sit but which jurisdiction can compel access to them. Its NeoDrive storage service targets business use directly, and the group has moved aggressively into sovereign and GPU-backed offerings.
Pros
Cons
Best for: Organisations that need Indian ownership as well as Indian hosting — government suppliers, PSUs, and firms with contractual sovereignty requirements.
Rated-4 data centres and the strongest uptime engineering
CtrlS operates Asia's largest Rated-4 data centre network, a tier classification that demands full fault tolerance with every component independently redundant. For workloads where downtime is the primary risk rather than cost, that engineering is the differentiator. Its footprint spans Hyderabad, Mumbai, Bengaluru and Noida, and it has expanded into GPU infrastructure alongside conventional storage and colocation.
Pros
Cons
Best for: BFSI, healthcare and any regulated business where an outage costs more than the infrastructure does.
The only Indian option that feels like a normal team drive
Zoho is an Indian company headquartered in Chennai with its own data centres, and WorkDrive is the one provider on this page that a non-technical team can simply use — shared team folders, desktop sync, document editing, permissions — rather than something an infrastructure team has to assemble. From ₹250 per user per month for 1 TB of shared team storage, it is also the most affordable route to Indian data residency by a wide margin, and it comes with the rest of the Zoho suite alongside.
Pros
Cons
Best for: Small and mid-size Indian businesses that want residency without hiring anyone to manage infrastructure. The pragmatic default on this page.
Sovereign-focused, strong on CERT-In and government work
ESDS, based in Nashik, has built its position around sovereign hosting and compliance rather than scale. Its eNlight platform and CERT-In-aligned operations make it a recurring choice in government tenders and for organisations that need to demonstrate a compliance posture rather than simply assert one. For buyers whose procurement process asks for empanelment and audit documentation, ESDS tends to have the paperwork ready.
Pros
Cons
Best for: Government suppliers, PSUs and regulated organisations whose procurement demands documented compliance evidence.
Enterprise ICT with managed services wrapped around storage
Both operate substantial Indian data-centre estates and sell storage as part of a wider managed enterprise offering rather than as a self-service product. Sify combines network, data centre and managed services, which suits organisations that would rather hold one contract than assemble connectivity and storage separately. NxtGen has a strong multi-city presence and emphasises high availability. Neither is where you go for a simple team drive; both are relevant for multi-site enterprises needing infrastructure managed for them.
Pros
Cons
Best for: Mid to large enterprises wanting Indian hosting delivered as a managed service alongside connectivity.
Data in India, company abroad — and for most buyers that is fine
All three global hyperscalers operate Indian regions, so choosing Mumbai or Hyderabad keeps your data physically in India with far deeper tooling than any domestic provider offers. The distinction that matters is jurisdiction rather than geography: the operating entity is foreign, so foreign legal process can in principle reach the data even while it sits on Indian soil. For the large majority of Indian businesses this is an acceptable trade, and the DPDP negative-list framework does not prohibit it. It becomes a genuine problem only where sovereignty is contractually or sectorally mandated.
Pros
Cons
Best for: Most Indian businesses that want data in India with a proper cloud platform around it, and have no contractual sovereignty requirement.
No, not generally. The DPDP Rules notified on 13 November 2025 use a negative-list approach: personal data may be transferred to any country by default, unless the Central Government specifically restricts that destination. This is deliberately more permissive than the whitelist model used elsewhere. A real localisation obligation does exist for Significant Data Fiduciaries in respect of categories the government will notify, but as of mid-2026 neither the SDF list nor those categories have been published, and the cross-border provisions take effect in May 2027.
Four situations. RBI's payment data directive requires payment system data to be stored in India. Sectoral regulators in insurance, banking and telecom impose their own rules, and Section 16(2) of the DPDP Act preserves any law that sets a higher bar. Significant Data Fiduciaries will face category-specific localisation once notified. And most commonly of all, enterprise and government customers write residency into contracts regardless of statute — in practice this drives more residency decisions than the law does.
Safer is the wrong axis. AWS Mumbai gives you better engineering, richer tooling and more mature security certifications than most domestic providers. An Indian-owned provider gives you jurisdictional independence — the operating company sits under Indian law alone. If your concern is uptime and security, the hyperscalers generally win. If your concern is which government can compel disclosure, or your tender requires Indian ownership, a domestic provider is the answer. Decide which of those you are actually solving for.
Zoho WorkDrive, from ₹250 per user per month for 1 TB of shared team storage, and it is not close. The infrastructure providers on this page — Yotta, CtrlS, ESDS, Sify — sell capacity and managed services priced for enterprise engagements rather than per-seat drives. For a small or mid-size Indian business that wants residency without hiring an infrastructure team, WorkDrive is the pragmatic answer.
MeitY empanelment is a government assessment of cloud providers against defined security and operational criteria, and it functions as a procurement gate: government departments and many PSUs can only buy from empanelled providers. If you sell to government or are one, it is a hard filter. If you are a private business with no public-sector exposure, it is a reasonable quality signal and nothing more — plenty of good providers have no reason to seek it.
Both offer data-region controls that can pin primary data storage to India, though availability varies by plan tier and the setting is not applied by default — you have to configure it. Be precise about what is covered: primary data at rest is usually in scope, while backups, caches, telemetry and support access may not be. If residency is a contractual commitment rather than a preference, get the specifics in writing from the vendor before you sign it onward to your customer.
It usually speeds things up. Serving Indian users from Mumbai or Hyderabad rather than Singapore or Virginia removes real round-trip latency, and for interactive applications the difference is noticeable. The exception is where your workflow depends on services that only exist in certain foreign regions, in which case pinning storage to India can force awkward cross-region calls. For ordinary file storage and backup, Indian regions are both the compliant choice and the faster one.
Need Indian data residency without an infrastructure project? WhatsApp +91 98119 98370 — we supply Zoho WorkDrive and India-region Microsoft and Google tenancies with INR billing and GST invoice.